No, that wouldn't work. The server wouldn't know if the random number they got back really came from the correct phone or was spoofed. The only thing the servwr can control is where it sends the code to - so the best security is sending it to a different device from the one the attacker might be using, the computer.

The server would know it came from the correct device because of the initial setup of the key like in any two factor auth app.